growse
Joined 15 years ago
Joined 15 years ago
See, no colons in sight!
(Half joking).
> That passkeys come with some limitations, like oh by the way, now you're stuck paying Apple/Google/1password a subscription fee for the rest of your life, is merely a happy side effect for the corporation.
I see this, but I disagree with the conclusion for two reasons.
1) there's no evidence of this happening in the consumer passkey space despite enormous opportunity.
2) we already have instances of lock-in to services by service providers. Whether it's banks demanding you use their little weird dongle to login, or apple demanding you use an iDevice to use airtags or parental controls. This is, I agree, a problem. But the market seems to be working it out quite well
Hence my question about "why though?". The only answer I can see is "user control", but I have no idea what that is. It sounds like a means, but to what end?
Lots of places where you might have specific requirements about your authenticating users. E.g. to achieve FIPS compliance, or if your user population is low-single-digits because it's critical national infrastructure.
> I want them to all have to invent their own, so that most of them will make mistakes that let the attestation be bypassed and freedom be restored.
I most definitely do not want operators of CNI to be "inventing their own" that can trivially allow compromise or weakness. "User freedom" is not the prevailing value in a lot of authentication contexts.
https://cphpost.dk/2026-10-10/news/round-up/123456-password-...
Attestations were added so that highly specific domains where attestation is required (by law, a regulator etc.) can still use the same passkey spec as everyone else without having to invent their own thing.
If there was benefit to BigTech of locking in Auth to a specific device, they'd have done it long ago - it's not difficult.
What's any of that got to do with passkeys and attestation?
If you sample the CPU usage at 1Hz, the metric is attached to the tick event.
1. A spec 2. A ref implementation
Similar to other projects (e.g. python), if there's complaints about (2), that should trigger an ecosystem of alternative implementations that are guaranteed to be compatible because of (1).
I suspect there's actually quite a few private, separate otel implementations. Maybe these just aren't being contributed as oss?